Are there any side effects of leaving Immich public? I think people overestimate the risks. Just update your stuff regularly, follow simple rules, and set up something like CrowdSec. I know it's simpler to just use Tailscale and similar tools, but recently I see the trend that people don't even consider otherwise.

I'd throw it behind Wireguard, personally. Belt and suspenders.

(I keep meaning to look at it and keep kicking it down the road.)